Privacy policy

What SirTripsALot holds about you

• Your account. The email address you sign in with. With an emailed link or a passkey there is no password at all; a password, if you set one, is kept by the sign-in service only as a one-way hash, and nobody can read it back.

• Your trips and bookings. Flights, stays, activities, confirmation codes, seats, the names of the travelers on a booking, prices and points, and anything you type into a booking or a debrief. These are the point of the app.

• Ideas you add to a trip. A title, a place, a note, and a day, kept with the trip and deleted with it. A short Google Maps or Apple Maps link you share is opened by SirTripsALot’s server to find the place. If a shared map link names a place but doesn’t include its location, SirTripsALot sends the place’s name and any address in the link to Google Places to find it. Ideas stay on your own trip: they aren’t in a link you share, your calendar feed, or what an assistant you connect can see.

• Booking emails, if you connect a mailbox. With your permission SirTripsALot reads your Gmail or Outlook mailbox for booking confirmations. Apart from the records described below, it doesn’t keep your mail, and it stops reading the moment you disconnect the mailbox. If you forward an email to your SirTripsALot address instead, only that email is read.

  For each email it acted on, it keeps the email’s text, up to 8,000 characters, so you can see why, along with any ticket or receipt attached to it, filed as a document on the trip.

  When it reads an email and doesn’t add it, because it isn’t travel, repeats a booking you already have, is a cancellation, or is one you dismissed before, it keeps the sender, the subject, when it arrived, what it read, and the email’s text, up to 8,000 characters, so you can see why it was left out and add it anyway. It keeps the same when it tried to read an email and couldn’t. For an email from a sender you’ve marked as not travel, one it has already handled, or one your mailbox wouldn’t hand over, it keeps only the sender, the subject, and when it arrived. An email with no booking details in it, or one from another trip tracker, leaves no record. After 90 days each of these records is cleared down to your mailbox’s id for the message, which says nothing about the email and only tells SirTripsALot it has already looked.

  Separately, for emails turned away by their subject line alone, it keeps a short list so you can add one yourself: the sender, the subject, when it arrived, and your mailbox’s id for the message. This list doesn’t keep any email’s text or attachments. Only the most recent 25 per mailbox are kept, and older ones drop off. When you tap Add it, SirTripsALot fetches that one email from your mailbox again and reads it like any other booking email, so if it still isn’t added, it gets the record described above.

  Disconnecting a mailbox deletes its short list and your “Not a booking” answers for it. It doesn’t clear the other records above; deleting your account does.

• Documents you upload. Tickets, receipts, visas, and, in the vault, your passport, arrival form confirmations, and their photos. A visa’s or an arrival form’s country and dates are compared with your trips on your own trip pages, and nowhere else. They are stored privately, in your own folder, and shown to you through links that expire after two minutes. With Pro, if you allow a connected assistant to open the files on your bookings, it gets its own link to each file it asks for, which works for five minutes. Your passport, visas, and arrival forms are never shown to an assistant. On the phone, opening one asks for Face ID or Touch ID, or on Android the phone’s fingerprint, face, or screen lock; the check happens on the device and never reaches us.

• Card benefits. If you tell us which credit cards you hold, we keep the cards you chose from our list, the nickname you give each one, the month it was opened (and the day, if you add it), the annual fee you set for it, which of its benefits you track and whether reminders are on, the uses you log (an amount, a date, and an optional note or booking), any repeating uses, and the dates and status of certificates you record. We never ask for or keep a card number, and none of this is read from your email, your bank, or your card issuer. It’s used only to show what’s left on each benefit, to show your credits used against your annual fee, and to send your reminders. We also keep when your phone last set up your card reminders, so we email you only the ones it couldn’t show. It’s included when you download your data, and deleting your account deletes it. If you tell us a benefit looks wrong, or that your card isn’t listed, we keep what you chose and wrote, which card and benefit it was about, and when you sent it, so we can check it against the issuer’s own page. The reports we act on are also read by the AI tools we use to check them against the issuer’s terms and fix the catalog, without your name or account. We delete each report 90 days after it’s resolved, and deleting your account deletes them.

• Points expiry. If you record when a loyalty balance expires, we keep the program’s name, the balance if you enter one, its expiry date or how many months without activity it allows and your last activity date, whether reminders are on, and when your phone last set up those reminders, so we email you only the ones it couldn’t show. We never ask for a loyalty number or password, never connect to a loyalty account, and none of this is read from your email. It’s used only to show when each balance expires and to send your reminders. It isn’t available to an assistant you connect. It’s included when you download your data, and deleting your account deletes it.

• Travel credits. If you record an unused travel credit, we keep who issued it, its amount and currency, the date it expires, the credit’s number or code if you enter one, any note you add, whether reminders are on, and when your phone last set up those reminders, so we email you only the ones it couldn’t show. The number or code stays hidden until you choose to show it, and it’s never in a reminder, an email, or a trip you share. We never connect to an airline or travel account, and none of this is read from your email. It’s used only to show what each credit is worth and when it expires, and to send your reminders. It isn’t available to an assistant you connect. It’s included when you download your data, and deleting your account deletes it.

• Where you are, while the app is open. Only if you allow it: to say how far you are from your next stop, to suggest the local currency in the currency converter, and to work out how long it takes to reach the airport. Your location is used on the phone, never sent to SirTripsALot, and not stored. To estimate the time to the airport, an iPhone asks Apple Maps for directions from your stay or your current location; Apple’s privacy policy covers that request.

• A notification token. If you allow notifications, the phone gives us a token so we can send them: news about your flights, a note when a booking is filed from your email, and silent updates that keep your widget current. Reminders such as check-in and free cancellation are set on the phone itself. While a flight is on your iPhone’s Lock Screen, the phone gives us a second token for that display alone, so its gate and times can be updated there; we delete it when the display ends, at most a few hours after you land.

  On an iPhone, the phone also gives us a token that lets us put your flight on the Lock Screen when its day comes, without your opening the app; we keep it while you’re signed in on that phone and delete it when you sign out there.

• When you open the app. The app on your phone tells us when it’s opened, which phone it’s on (its model and its iOS or Android version), and which version of the app it is. What we record when something goes wrong is described below. We keep the latest of these, and the dates of the days it was opened. When it was last opened is used for one thing: if you haven’t opened the app since your phone showed a reminder about check-in or an arrival form, we may send the same reminder by email. The phone and app version are used to label a report you send us as a tester, so we can see what you were using. Turn reminder emails off in Settings → Notifications, or from the link in any of them.

• Keeping the app working. To see whether new testers are getting set up, we look at what your account already shows: when you first signed in, whether you connected a mailbox or forwarded a booking, when your first trip was filed, and the days you opened the app. When something goes wrong in the app, on the web or on your phone, we record what failed and on which screen, as a fixed error code and the screen’s name, with the app’s version, an iPhone’s model, and the time, linked to your account so we can fix it for you. Errors on our own servers are recorded the same way, without being linked to an account. An error record names what failed, not what you typed or what your bookings, documents, or email say. We keep these records for 90 days, and deleting your account deletes the ones linked to it.

• Citizenship. Which countries you’re a citizen of, if you add them or a passport you saved shows it. It’s used only to decide which travel limits apply to you, such as the 90 days in Europe that EU, EEA, and Swiss citizens don’t have.

• Home airport, timezone, and currency. Set by you, or inferred from your flights and shown to you as such.

• Copies on your phone and in your browser. So your trips open without a connection, the app on your phone keeps a copy of your itineraries, and of any documents you download, on the phone. Signing out of the app deletes them. Downloaded documents are left out of the phone’s backups (iCloud and computer backups on an iPhone, Google’s on Android), because they can be downloaded again. On the web, a trip you save for offline is kept in that browser until you remove it from the trip’s page.

What it does with that

Builds your itinerary, counts your days in Europe against the 90-in-180 rule, counts the countries you have been to, converts expenses, works out what your points bought, and checks your passport’s expiry against your booked trips. Every calculation runs for you and is shown to you. Nothing is sold or used for advertising. We don’t train AI models on your data, and Anthropic, whose model reads your bookings, may not use them for training.

To find where SirTripsALot misreads emails you forward or share, we count how often you add or dismiss what we found, by the sender’s web domain (such as an airline’s), and which fields you correct, never the email’s words, the values you change, or anything from a connected mailbox.

Who else sees it

• The services that run SirTripsALot. Supabase stores the data and handles sign-in, and Vercel runs the site. Vercel also counts visits to the website: which page was opened, the site that linked to it, and your country, browser, and type of device. It sets no cookies, and the page address it receives never includes a trip, a share link, or anything after the page’s name.

  We also count page views with Umami, which we run ourselves on Vercel, with its counts stored by Neon: the same page addresses, never a trip, a share link, or anything after the page’s name; the website that linked to it, by its domain alone, such as google.com; your browser, operating system, type of device, language, and screen size; and the country, region, and city your IP address roughly points to. It sets no cookies and doesn’t keep the IP address. To tell one visitor from another, it keeps a code made from the IP address and browser, and makes a new one each month.

  We also count visits ourselves, by day: how many came from each country, region, and city that a visitor’s IP address roughly points to, and whether from the website, the iPhone app, or the Android app. On the website, when an Android phone’s browser shares the phone’s model, we count that model on its own, never with a place. We don’t keep the IP address, an account, or anything that identifies a person or device with these counts, and we delete them after 90 days.

  Postmark sends SirTripsALot’s emails and receives the bookings you forward and testers’ reports. Cloudflare runs the domain’s addresses and email routing, and stores SirTripsALot’s encrypted nightly backups; GitHub runs that backup, making the copy of the database before it is encrypted. Expo passes the app’s notifications on to Apple to deliver to an iPhone, or to Google’s Firebase Cloud Messaging to deliver to an Android phone, and SirTripsALot sends the flight on your iPhone’s Lock Screen to Apple directly: its flight number, airports, times, gate, and status. Test versions of the Android app reach testers through Google Play’s closed testing, which holds each tester’s email address and details of the phone the app is installed on. Each holds what it needs on SirTripsALot’s behalf and under its instructions.

• Reading your bookings. The text of a booking confirmation — one you paste, one you forward, or one SirTripsALot finds in a connected mailbox — is sent to an AI model (Anthropic’s Claude) to be turned into a structured booking. Only that email goes, never the rest of your mailbox, and Anthropic may not use it to train its models. A file you share to SirTripsALot is checked on SirTripsALot’s own server first: if it looks like one of your travel documents (a passport, visa, arrival form, or similar), it isn’t sent to an AI model at all. A receipt you scan into an expense is sent as a photo or PDF to the same AI model to read its total, currency, date, and the business’s name. When you scan a receipt, we read it and then delete it, unless you choose to keep it with the expense. A kept receipt is stored with your trip’s documents, and deleting the expense deletes it. A screenshot of a booking that you share or upload is read for its words: in the app on your phone they’re read on the phone itself, and only the words are sent to be read; uploaded on the web, or when the phone can’t read it, the picture is sent to the same AI model to write out its words. The words are then read like any booking you paste. Either way, a small copy of the picture is saved with the booking it adds, as one of its documents.

• Hotel bills. Hotel bills you forward or share are read by an AI model to add their charges to your expenses. Only the bill’s text is sent to the model, never the PDF itself, and Anthropic may not use it to train its models, as with bookings. A bill is kept as a receipt with its expense only if you’ve said yes to keeping receipts. A hotel bill’s email text, up to 8,000 characters, is kept with its expense so you can see where the charges came from, and is deleted with the expense. A bill that isn’t on a trip is cleared after 90 days. From a connected mailbox, bills are read only after you say yes for that mailbox.

• Emails you send us from a booking. If you choose “Something wrong with how this booking was imported? Let us know.” on a booking from an email you forwarded or shared, and send us that email, we keep only a copy with names, confirmation codes, card numbers, addresses, and the like removed, with the note you add. If our check finds anything that may still be personal, we keep only your note. The person who runs SirTripsALot and the AI coding tools we use read it to fix how emails like it are read. The providers of those tools may keep what they were shown under their own terms; it is only ever the copy with those details removed, or your note. We delete our copy once the fix ships, or after 90 days at the latest, and the copies in our nightly database backups are gone within 30 days after that. Only made-up examples based on it are kept in our tests. For a booking from a connected Gmail or Outlook, only your note is sent, never the email.

• Help improve how emails are read. If you turn this on in Settings, we keep a copy of each email you forward or share for 90 days, to fix how emails like it are read. Before a copy is kept, the AI model that reads your bookings (Anthropic’s Claude, on the same terms) removes names, confirmation codes, ticket and card numbers, email addresses, phone numbers, street addresses, loyalty numbers, and links. We also remove the names and codes on the booking itself, then check for anything that still looks like a code, number, address, or link: if we find one, the email isn’t kept. The person who runs SirTripsALot and the AI coding tools we use read these copies, and the same AI model may be given them to write made-up examples for our tests. The providers of those tools may keep what they were shown under their own terms; it is only ever the copy with those details removed. Mail from a connected Gmail or Outlook is never kept. Turning it off deletes the copies we kept, and the copies in our nightly database backups are gone within 30 days after.

• Tester feedback. If you’re testing SirTripsALot and email feedback@sirtripsalot.com, or reply to your invitation, we keep that email: its subject and words, the screenshots attached to it, and the address it came from. If that address belongs to a SirTripsALot account, we link the report to the account and to the phone and app version the app last reported: the phone’s model, its iOS or Android version, and the app’s version. If you test the iPhone app and send feedback through TestFlight, Apple passes us what you sent: your comment, any screenshots, the email address of your Apple Account, your phone’s model and iOS version, the app’s version, and, after a crash, the crash report. We keep these and delete them with the reports emailed to us, as this section describes. We keep it to find and fix what testers report, and the person who runs SirTripsALot reads it. To sort each day’s reports, their words, not the screenshots or crash reports, are sent to an AI model (Anthropic’s Claude), which may not use them to train its models. The reports we act on are also read by the AI coding tools we use to fix what they describe. The reports and their screenshots are kept in private storage, and we delete all of them 90 days after SirTripsALot launches. The copies in our nightly database backups are gone within 30 days after that.

• Rates, weather, maps, and flights. Exchange rates come from SirTripsALot’s server, which asks free public rate services for them. Those requests carry only a currency and a date, nothing about you or your trip. Weather comes from Open-Meteo, place search from Google, a trip’s cover photo sometimes from Wikimedia, and flight status from aviation data providers; SirTripsALot’s server asks them, and the request carries the place, the words you searched, or the flight number, never your name or account. Maps are different: they load straight from Mapbox or OpenStreetMap on the web, Apple Maps on an iPhone, and Google Maps on Android, so those services see your network address and the area the map shows. What the flight providers tell us (gates, terminals, delays, baggage belts) is cleared from your booking about a week after the flight; what your own confirmation said stays.

• People you share with. If you share a trip by link, anyone holding the link sees the itinerary: what, when, and where. Confirmation codes, prices, other travelers’ names, and documents are not included. You can replace or stop the link at any time.

• Your calendar, if you subscribe. Your trips’ calendar feed includes each booking’s times, places, and confirmation code. The calendar app you subscribe with keeps its own copy. Replacing the feed’s link in Settings stops new updates, but doesn’t remove what a calendar already holds.

• AI assistants you connect. If you connect an AI assistant such as Claude, ChatGPT, or Gemini to SirTripsALot, it can read your trips, bookings, spending, and countries when you ask it to. If you also allow it, it can add bookings and trip ideas, see the subject, sender, and a short excerpt of emails you forwarded to us and file them into a trip, and read or attach files on your bookings. It can’t edit or delete your trips or bookings, and it can never see your travel documents or the emails and attachments from a connected mailbox. A booking SirTripsALot filed from a connected mailbox is shared like any other booking — its dates, places, confirmation code, and price — but never the email it came from or its attachments; you choose this when you allow the assistant. Other travelers on a booking are left out, except where an email you forwarded or a file you attached names them. What it does with what it reads is governed by that assistant’s own terms. You can disconnect it at any time in Settings → Connections.

• Your mailbox provider. Connecting Gmail or Outlook goes through Google’s or Microsoft’s own consent screen, and you can revoke it there as well as in SirTripsALot.

Nobody else. There are no advertisers and no data brokers, and nothing follows you across other apps or sites.

Mail from Google and Microsoft

SirTripsALot’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The same rules apply to mail read from Microsoft Outlook.

• Mail is read with read-only access, only to find and file your bookings, and only for you.
• It is never sold, never used for advertising, and never used to train AI models, ours or anyone else’s.
• It is shared only with the services named above, and only to do that job: the parsing model reads a booking email to file it, and the storage provider holds what was filed.
• Nobody at SirTripsALot reads your mail. The only exceptions are when you ask us to look at a specific email to fix a problem, when it is needed for security, or when the law requires it.
• Disconnecting a mailbox in SirTripsALot’s Inbox deletes its access tokens and asks Google to revoke SirTripsALot’s access. You can also remove it from your Google account or your Microsoft account.

How your data is protected

What SirTripsALot holds from your mailbox, your bookings, and your documents is protected in these ways:

• Encrypted in transit. Everything between your browser or phone, SirTripsALot’s servers, its storage provider, and Google or Microsoft travels over HTTPS (TLS).

• Encrypted on the servers. The storage provider encrypts the database and stored files on its disks. The keys that let SirTripsALot read your mailbox (OAuth tokens) are also encrypted by SirTripsALot itself with AES-256-GCM, under a key held only on its servers, so the stored tokens are useless to anyone who reads the database without it.

• Only you can reach your data. Every row is tied to your account, and the database itself refuses any other account’s request for it. SirTripsALot’s own server reaches it only to do the work described on this page. Your documents are in private storage, and each view is a link that expires after two minutes, or five for a booking file you let an assistant open.

• The least access needed. Mail is read with read-only access. SirTripsALot keeps what it filed and the short excerpts described above, not your mailbox, and clears its record of emails it didn’t add after 90 days.

• Limited people. Only the people at M Ho Studios LLC who run SirTripsALot can reach the systems that hold your data, under the rules in “Mail from Google and Microsoft” above.

• On the phone. Your travel documents open only after Face ID, Touch ID, or your passcode, or on Android the phone’s fingerprint, face, or screen lock. That’s a lock on opening them in the app, not separate encryption: the copies kept on the phone are protected by the phone’s own security, and a file you save or share out of the app is yours to look after.

How long it is kept

For as long as you have an account. Delete a booking, a document, or a trip and it is gone from your account then; delete a booking and its email’s text and the details read from it go too, and only the message’s id is kept, so the same email isn’t added again; disconnect a mailbox and its sync tokens are deleted then. The things kept for less time are the record of emails SirTripsALot looked at and didn’t add, and a hotel bill that isn’t on a trip: after 90 days only the message’s id is left. SirTripsALot keeps its own nightly backup of the database, encrypted, and deletes each one after 30 days; the files you upload aren’t in it.

Deleting your account

You can delete your account yourself, inside the app: on the web under Settings → Account, on the phone at the bottom of Settings. Deleting removes your account, every trip and booking, every expense, every connected mailbox, and every file you uploaded, at once and permanently. If a file can’t be removed right away, a daily job keeps trying until it is. There is no waiting period and nothing to email us for. Two things last a little longer: the encrypted nightly backups, each deleted after 30 days, and, if we delete an account for you, a note in our own admin log that we did, whose email address is cleared after 90 days. Error records from our servers, which aren’t linked to any account, are deleted on their own 90-day schedule.

Updates list

If you sign up for updates, SirTripsALot keeps your email address and when you confirmed it, and uses your address only to tell you about SirTripsALot’s availability and news. Every email from the list has an unsubscribe link. Unsubscribing stops them and deletes your answers below; your address stays, marked unsubscribed, so it isn’t emailed again. An address that is never confirmed is deleted after 30 days. To limit sign-ups from any one network, it also keeps a one-way code made from the network address and browser a sign-up came from, never the address itself. Signing up is not an account. If you tick the tester box, SirTripsALot also keeps that choice and the devices you picked, and may email you an invitation to test. Testing starts only if you accept.

If you sign up from a link someone shared, SirTripsALot also keeps which link it was, and uses it to show the person who shared it how many people have joined the waiting list from their link. Your name and email address aren’t shown to them. If you’re later invited and make an account, your account notes who shared the link with you. That note is removed if either account is deleted, and the link record is removed when you unsubscribe or are taken off the list. You can also ask us to remove it and keep your account. Every account has its own share link, which is deleted with the account.

If you also answer “How do you travel?”, SirTripsALot keeps those answers with your email: your phone, where your booking emails arrive, how and how often you travel, your home country, how you organize your travel plans now, how important each feature is to you, and anything you write in the last box. Every question is optional. They’re used only to choose who tries SirTripsALot first and what to build next, are read by SirTripsALot alone, and are deleted when you unsubscribe.

Your choices

• Location, notifications, camera, and photos are each a permission the phone asks for, and each can be refused or withdrawn in the phone’s Settings without losing anything else.
• Face ID or Touch ID, or on Android the phone’s own lock, for the list of your travel documents and for the app itself are switches in Settings → Sign-in and security, on the phone. The one for travel documents is on unless you turn it off; a travel document itself always asks when it opens.
• A connected mailbox can be disconnected from the Inbox at any time, on the web or the phone.

Children

SirTripsALot is not for children under 13 and does not knowingly hold their data.

Changes

When this page changes, the date at the top changes with it. Anything that widens what is collected will be said on the sign-in page before it takes effect.